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ABSTRACT 


PATENT 


A broad-scope intrusion detection system analyzes traffic coming into multiple hosts 
or other customers' computers or sites. This provides additional data for analysis as compared 
5 to systems that just analyze the traffic coming into one customer's site. Additional detection 
schemes can be used to recognize patterns that would otherwise be difficult or impossible to 
recognize with just a single customer detector. Standard signature detection methods can be 
used. Additionally, new signatures can be used based on broad-scope analysis goals. An 
anomaly is detected in the computer system, and then it is determined which devices or 
1 0 devices are anticipated to be affected by the anomaly in the future. These anticipated devices 
are then alerted to the potential for the future anomaly. The anomaly can be an intrusion or 
an intrusion attempt or reconnaissance activity. 


